Data Protection Framework: Filing, Principles, and Recertification

To self-certify to the EU-U.S. Data Privacy Framework, a U.S. organization under Federal Trade Commission or Department of Transportation jurisdiction must publish a DPF-compliant privacy policy, choose an independent recourse mechanism for handling complaints, file through the official Data Privacy Framework portal, pay a revenue-based fee, and then recertify every year while complying with the program’s seven privacy principles.¹ The program lets participating companies legally receive personal data from the EU, the UK, and Switzerland once the Department of Commerce’s International Trade Administration approves the submission.²

Who Can Self-Certify

Only U.S. legal entities subject to the investigatory and enforcement jurisdiction of the FTC or DOT are eligible. If your organization sits outside both agencies’ reach, self-certification is not available to you and you will need a different transfer mechanism.¹ The FTC covers most commercial entities. DOT handles airlines and shares jurisdiction with the FTC over ticket agents.³

Choose Which Frameworks Apply

The DPF program is actually three frameworks. Which ones you certify to depends on where the data you want to receive originates.

The EU-U.S. DPF covers transfers from the European Union and European Economic Area.
The UK Extension covers transfers from the United Kingdom and Gibraltar, effective October 12, 2023.
The Swiss-U.S. DPF covers transfers from Switzerland, effective September 15, 2024.⁴

You can self-certify to one, two, or all three. Each additional framework carries a supplemental fee and requires your privacy policy to address the corresponding principles. If you opt into the UK Extension, you must treat special category data and criminal offence data as sensitive information under the DPF.⁵

What to Prepare Before You File

Most of the real work happens before you touch the portal. You need a DPF-compliant privacy policy, an independent recourse mechanism, and a decision about what kinds of data you will cover.

The Privacy Policy

Your published privacy policy must include a statement that the organization adheres to the DPF Principles, a hyperlink to the official DPF program website, and information about how individuals can file complaints. One point trips up first-time applicants: a new organization cannot publicly claim DPF participation in its privacy policy until the DPF team notifies it that the submission is complete. Draft the policy in advance, but hold the compliance statement until you’re approved.¹

Independent Recourse Mechanism

You must select an IRM to handle unresolved privacy complaints. For non-HR data, that means choosing a private-sector dispute resolution provider and linking to that provider’s complaint form in your privacy policy. For HR data, you must commit to cooperate with and comply with the advice of the relevant European Data Protection Authorities.⁶

HR Data, Non-HR Data, or Both

When you self-certify, you specify whether you will receive human resources data, non-HR data, or both. HR data carries the additional obligation of mandatory cooperation with European Data Protection Authorities.⁵

Filing Through the DPF Portal

The actual filing happens through a centralized digital portal where an authorized representative creates a secure account. You enter the company’s legal name, U.S. mailing address, the web address where the privacy policy is published, the types of data covered, and which of the three frameworks you’re joining. Subsidiaries that will be covered by the same certification must be identified in the submission.

Fees run from roughly $250 to $3,500 based on annual revenue, with an additional charge for each supplemental framework beyond the first. After payment, the International Trade Administration reviews the submission to confirm it meets all requirements. Review typically takes several weeks. Once approved, you receive “active” status and appear on the public DPF participant list.¹

The Seven Principles You’re Committing To

Self-certification is a legally enforceable promise that your organization will follow all seven principles across the personal data you receive under the framework.

Notice. Tell individuals what personal data you collect, what you do with it, who you share it with, and how they can contact you or complain. Disclose this at or before collection, or as soon as practicable afterward.⁷

Choice. Give individuals the ability to opt out before their data goes to an unrelated third party or gets used for a purpose materially different from the original one. For sensitive information such as health data, racial or ethnic origin, or trade union membership, the standard is affirmative opt-in consent.

Accountability for Onward Transfer. When you pass data to a third-party agent, ensure that agent applies at least the same level of protection. You remain liable if the agent processes the data in violation of the principles, unless you can prove you bear no responsibility for the event.⁷

Security. Take reasonable precautions to protect data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. What counts as reasonable scales with the sensitivity of the data and the context of processing.

Data Integrity and Purpose Limitation. Keep data reliable for its intended use, limit it to what is relevant for the stated purpose, and do not process it in ways incompatible with the original purpose of collection.

Access. Individuals must be able to see what personal data you hold about them and to correct, amend, or delete information that is inaccurate or that was processed in violation of the principles.⁷

Recourse, Enforcement, and Liability. Provide a functioning complaint process, designate an independent recourse mechanism, cooperate with regulators, and accept that violations can trigger FTC enforcement.

Annual Recertification

Certification is not permanent. Every participating organization must recertify annually with the ITA. The ITA removes any organization that fails to complete recertification, and once removed, you can no longer receive personal data under the program.⁸

Recertification requires verifying that your contact information, corporate structure, privacy policy, and IRM selection are still accurate. If your data handling practices have changed, update the privacy policy before recertifying. Run an internal review of what your systems actually do against what your policy says. Gaps between the two are where compliance problems usually surface.

How Complaints Get Handled Once You’re Certified

The framework builds a layered complaint structure, and each layer must be exhausted before the next one is available.

First, the individual complains directly to your organization. If that doesn’t resolve the issue, they escalate to your IRM. For non-HR data, that’s the private-sector dispute resolution provider you selected. For HR data, the complaint goes to the relevant European Data Protection Authority, and you must cooperate with and comply with that authority’s advice.⁶

As a last resort, individuals in the EU, UK, or Switzerland can invoke binding arbitration. A panel of one or three arbitrators, administered by the International Centre for Dispute Resolution, can order specific non-monetary relief such as data access, correction, or deletion. The panel cannot award damages, costs, or fees.⁹

Enforcement Risk

The ITA runs the program administratively, but enforcement is a separate matter. The FTC treats misrepresenting DPF compliance or failing to honor privacy commitments as an unfair or deceptive practice under 15 U.S.C. § 45.¹⁰ Civil penalties for violating an FTC order can reach $53,088 per violation as of 2025, and those levels remain in effect for 2026 because the Bureau of Labor Statistics was unable to produce the October 2025 consumer price data needed for an inflation adjustment.¹¹ DOT enforces against airlines and shares jurisdiction over ticket agents.³ European Data Protection Authorities have direct authority over HR data complaints. Non-HR cooperation with DPAs is optional but encouraged.

If You Withdraw From the Program

Leaving the framework does not end your obligations to the data you already received. Once you withdraw or are removed, stop claiming participation on your website, in marketing materials, and in privacy policies immediately.¹² Then choose one of three options for the personal data you already hold:

Keep the data and continue applying the DPF Principles, affirming annually to the ITA that you still protect it under the framework’s standards.
Keep the data under alternative protections, such as standard contractual clauses that provide adequate protection.
Return or delete the data by a specified date.

Choosing the first option creates an ongoing administrative burden. You submit a Post-withdrawal Annual Affirmation Questionnaire to the ITA and pay $260 per year for each framework you were certified under. The filing is due within the two months before, but no later than, the anniversary of your withdrawal date, and the obligation continues until you switch to alternative protections, return the data, or delete it and notify the ITA.¹² Failing to honor the commitments you made when the data was transferred can still trigger FTC enforcement for deceptive practices long after you leave the list.

1
International Trade Administration. How to Join the Data Privacy Framework (DPF) Program (Part 1)
2
Federal Trade Commission. Data Privacy Framework
3
U.S. Department of Transportation. Air Consumer Privacy
4
International Trade Administration. Data Privacy Framework Program Overview
5
Information Commissioner’s Office. How Does the UK Extension to the EU-US Data Privacy Framework Work
6
Data Privacy Framework. FAQs – Privacy Policy (6-10)
7
Data Privacy Framework. Data Privacy Framework – 1 Notice
8
Data Privacy Framework. How to Re-Certify Under the Data Privacy Framework (DPF) Program
9
Regulations.gov. ITA FRDOC 0001-11663
10
Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful; Prevention by Commission
11
Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025
12
Data Privacy Framework. Withdrawal Under the Data Privacy Framework (DPF) Program